This document explains how to perform security scans on Docker images used in the deployer.
Regular security scanning ensures that Docker images used in production deployments are free from known vulnerabilities. This documentation provides:
- Instructions for running security scans
- Configuration guidelines
- Best practices for vulnerability management
For ongoing security monitoring, see Issue #250: Implement periodic security vulnerability scanning workflow.
The automated workflow will:
- Run Trivy scans on CI/CD pipeline
- Generate security reports
- Alert on new vulnerabilities
- Track vulnerability trends over time
# macOS
brew install trivy
# Linux (Debian/Ubuntu)
sudo apt-get install trivy
# Or use Docker
docker run --rm aquasec/trivy:latest image <image-name>Recommended Scan Command:
trivy image --severity HIGH,CRITICAL <image-name>Severity Levels:
CRITICAL: Exploitable vulnerabilities with severe impactHIGH: Significant vulnerabilities requiring attentionMEDIUM: Moderate vulnerabilities (optional to include)LOW: Minor vulnerabilities (typically noise)
# Scan the deployer image
trivy image --severity HIGH,CRITICAL torrust/tracker-deployer:latest
# Scan with all severities for full report
trivy image torrust/tracker-deployer:latest
# Scan and output as JSON
trivy image --format json --output report.json torrust/tracker-deployer:latest
# Scan specific image version
trivy image --severity HIGH,CRITICAL prom/prometheus:v3.5.0"OS is not detected" (Prometheus):
- Expected for minimal scratch images
- Application binary has zero vulnerabilities
- No OS packages to scan
"Alpine/Oracle Linux no longer supported":
- Cosmetic warning from Trivy's detection heuristics
- Official images are actively maintained by vendors
- Zero vulnerabilities confirm images are secure
If HIGH/CRITICAL vulnerabilities appear:
- Review vulnerability details in Trivy output
- Check if vendor has released patched image
- Update image version in
templates/docker-compose/docker-compose.yml.tera - Re-run security scan to verify fix
- Update scan documentation with new results
- ✅ Use official vendor images (prom, grafana, mysql, torrust)
- ✅ Pin to specific versions (not
latesttags in production) - ✅ Prefer LTS versions for production stability
- ✅ Verify support EOL dates before deployment
- 🔄 Scan images before deployment
- 🔄 Re-scan periodically (monthly recommended)
- 🔄 Monitor vendor security advisories
- 🔄 Update images when patches available
- 📝 Record scan dates and results in scans/
- 📝 Document update rationale
- 📝 Track support lifecycle dates
- 📝 Maintain historical scan records
See the scans/ directory for historical security scan results: